CVE-2019-25281: NCP Secure Entry Client Privilege Escalation

CVE-2019-25281 Overview

CVE-2019-25281 is an unquoted service path vulnerability affecting NCP Secure Entry Client version 9.2. This security flaw exists in multiple Windows services including ncprwsnt, rwsrsu, ncpclcfg, and NcpSec, allowing local users to potentially execute arbitrary code with elevated privileges. The vulnerability stems from improper handling of service executable paths that contain spaces but lack proper quotation marks.

Critical Impact

Local attackers with write access to certain directories can plant malicious executables that will be run with LocalSystem privileges when the vulnerable services start, leading to complete system compromise.

Affected Products

• NCP Secure Entry Client 9.2
• Windows services: ncprwsnt, rwsrsu, ncpclcfg, NcpSec
• Systems with writable directories in the unquoted service paths

Discovery Timeline

• 2026-02-05 - CVE CVE-2019-25281 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2019-25281

Vulnerability Analysis

This vulnerability is classified as CWE-428 (Unquoted Search Path or Element). When Windows services are configured with executable paths containing spaces that are not enclosed in quotation marks, the operating system attempts to resolve the path by parsing it at each space character. This parsing behavior creates an opportunity for privilege escalation.

For example, if a service executable is located at C:\Program Files\NCP\Secure Entry Client\service.exe, Windows will sequentially attempt to execute:

1. C:\Program.exe
2. C:\Program Files\NCP\Secure.exe
3. C:\Program Files\NCP\Secure Entry\Client\service.exe

If an attacker can place a malicious executable at any of these intermediate paths, it will be executed instead of the legitimate service binary, inheriting the service's privileges (typically LocalSystem).

Root Cause

The root cause is the improper configuration of Windows service paths during software installation. The NCP Secure Entry Client installer fails to wrap executable paths in double quotation marks when registering the ncprwsnt, rwsrsu, ncpclcfg, and NcpSec services with the Windows Service Control Manager. This oversight is a common security misconfiguration in Windows software deployment.

Attack Vector

The attack requires local access to the system where NCP Secure Entry Client 9.2 is installed. An attacker must have write permissions to a directory that appears in the unquoted path hierarchy. Once a malicious executable is planted (such as Secure.exe in C:\Program Files\NCP\), the code will execute with LocalSystem privileges the next time the service starts—either manually triggered, after a system reboot, or during service recovery operations.

The exploitation does not require user interaction once the malicious file is in place, and the attacker gains the full privilege level of the compromised service, which typically runs as SYSTEM.

Detection Methods for CVE-2019-25281

Indicators of Compromise

• Unexpected executable files in directories such as C:\Program.exe, C:\Program Files\NCP\Secure.exe, or similar intermediate paths
• Unusual process execution chains where ncprwsnt, rwsrsu, ncpclcfg, or NcpSec services spawn unexpected child processes
• Modified timestamps or new files appearing in writable directories along the service path hierarchy
• Service crash events followed by execution of non-standard binaries

Detection Strategies

• Audit Windows services for unquoted paths using PowerShell: Get-WmiObject Win32_Service | Where-Object { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }
• Monitor file creation events in C:\Program Files\NCP\ and parent directories for suspicious executables
• Implement application whitelisting to prevent unauthorized executables from running with elevated privileges
• Use endpoint detection and response (EDR) solutions to monitor service startup behaviors

Monitoring Recommendations

• Enable Windows Security Event logging for service control manager events (Event IDs 7000, 7009, 7045)
• Configure file integrity monitoring (FIM) on directories in the unquoted service paths
• Deploy SentinelOne agents to detect and alert on suspicious process execution patterns associated with service hijacking
• Regularly audit service configurations for unquoted paths as part of vulnerability management programs

How to Mitigate CVE-2019-25281

Immediate Actions Required

• Verify whether NCP Secure Entry Client 9.2 is installed on systems within your environment
• Manually correct the service paths by adding quotation marks around the executable paths in the Windows registry
• Remove any suspicious executables found in intermediate path locations
• Contact NCP for updated software versions that address this vulnerability

Patch Information

Review the NCP Software Resource page for updated versions of NCP Secure Entry Client that address this vulnerability. Additional technical details are available in the VulnCheck Advisory on NCP Secure Entry Client and the Exploit-DB #47668 entry.

Workarounds

• Manually quote the service paths in the Windows registry under HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\ImagePath
• Restrict write permissions on directories in the path hierarchy (e.g., C:\Program Files\NCP\) to administrators only
• Implement application control policies to prevent unauthorized executables from running
• Consider temporarily disabling the affected services if they are not critical to operations until patches are applied

# Configuration example - Fix unquoted service path via registry
# Run as Administrator in Command Prompt

sc qc ncprwsnt
# Check if ImagePath contains spaces without quotes

# Correct the path by wrapping in quotes (adjust path as needed)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\ncprwsnt" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\NCP\Secure Entry Client\ncprwsnt.exe\"" /f

# Repeat for other affected services: rwsrsu, ncpclcfg, NcpSec